Analysis
-
max time kernel
139s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
30-08-2022 21:33
General
-
Target
SecuriteInfo.com.W32.AIDetectNet.01.11564.5379.exe
-
Size
779KB
-
MD5
bec825008e3f4365a8a71961ba806f27
-
SHA1
a0f073d37901dd918af4e58f82a19e46479edc6b
-
SHA256
9e31da664bede9c4709cdbf2ec6a791dadc490cd30a67a3d2bbae42c7e9318ed
-
SHA512
c251ee9de6053e57a0547f31b3469a6dc70619b6562c5345f3d76b8ffbc06b07c86749908f8eae1a7216a9c0c41eb1bbcc22318f6e5eefd6b1ee206c62be7526
-
SSDEEP
12288:osUf0eH06SolylSx1XqVlSyH0f67ajvKVl94tu1UNPuEz4YTLvNcMb4IoR55KFe:Xg3uSyUi7Iq9Z1UpuRMPoR5E
Malware Config
Extracted
netwire
37.0.14.206:3384
-
activex_autorun
false
-
copy_executable
true
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
true
-
offline_keylogger
true
-
password
Password234
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 3 IoCs
-
Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
-
Executes dropped EXE 1 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.11564.5379.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.11564.5379.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WeVSCisyy" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBDAE.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.11564.5379.exe"{path}"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d5b5b71730889cd33363889a97bfd53b
SHA1c35c755535dfb83aa52516a3490a7fb46b1be0c9
SHA25633dcd7bc4aaee28397e1c32b03041576a1dd12fb822c1821070f0c8e9d78c103
SHA512f58a63b94a3153f5344115db66de27fa4439088e5c45bc9d51f088b712c11b9300bd7beb72529648e420fb69f5755577da6c51b73d61e89e108b39affafdf39d
-
Filesize
779KB
MD5bec825008e3f4365a8a71961ba806f27
SHA1a0f073d37901dd918af4e58f82a19e46479edc6b
SHA2569e31da664bede9c4709cdbf2ec6a791dadc490cd30a67a3d2bbae42c7e9318ed
SHA512c251ee9de6053e57a0547f31b3469a6dc70619b6562c5345f3d76b8ffbc06b07c86749908f8eae1a7216a9c0c41eb1bbcc22318f6e5eefd6b1ee206c62be7526
-
Filesize
779KB
MD5bec825008e3f4365a8a71961ba806f27
SHA1a0f073d37901dd918af4e58f82a19e46479edc6b
SHA2569e31da664bede9c4709cdbf2ec6a791dadc490cd30a67a3d2bbae42c7e9318ed
SHA512c251ee9de6053e57a0547f31b3469a6dc70619b6562c5345f3d76b8ffbc06b07c86749908f8eae1a7216a9c0c41eb1bbcc22318f6e5eefd6b1ee206c62be7526
-
-
-
Filesize
204KB
-
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
40KB
-
Filesize
808KB
-
Filesize
624KB
-
Filesize
584KB
-
Filesize
5.6MB